CVE-2019-1010301

An attacker crafts a JPEG file with malicious EXIF GPS directory entries that contain an illegally large number format or an excessive number of components [ref_id=1]. When jhead processes the file, `ProcessGpsInfo()` at `gpsinfo.c:151` uses `sprintf` with a `%9.6f` format string to format GPS coordinate values into a stack buffer; a manipulated value (e.g., a huge floating-point number) overflows the 50-byte destination buffer, triggering a stack buffer overflow [ref_id=1]. The attack requires no authentication—only that the victim opens the crafted JPEG with jhead [ref_id=1].

The vulnerability resides in `gpsinfo.c` at line 151 in the `ProcessGpsInfo()` function [ref_id=1]. The backtrace shows the crash occurs when `sprintf` writes GPS coordinate data into a fixed-size stack buffer without bounds checking [ref_id=1]. The function is called from `ProcessExifDir()` in `exif.c` (line 866) during JPEG EXIF parsing [ref_id=1][ref_id=2].

The Debian patch [ref_id=3] addresses a related heap-buffer overflow (CVE-2018-17088) by adding an integer overflow check before the offset+bytecount comparison: `if (OffsetVal > UINT32_MAX - ByteCount || OffsetVal+ByteCount > ExifLength)` [ref_id=3]. However, the stack buffer overflow at `gpsinfo.c:151` (CVE-2019-1010301) is not fixed by this patch; the advisory notes that the upstream author was unresponsive, and the Fedora/Ubuntu packages incorporated downstream patches [ref_id=1]. The fix for the stack overflow requires either using a bounded `snprintf` or validating the GPS value magnitude before formatting.